[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 1 Jan 2013 07:53:39 +0100
From: Lukas Odzioba <lukas.odzioba@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: How does JTR know what kind of hash to try to crack?
2013/1/1 John Hall <JohnH@...tworking.com>:
> Using JTR with jumbo patch to try to crack forgotten password to the Password Safe program http://passwordsafe.sourceforge.net/
>
> I believe the Password Safe program uses SHA-256 hash.
>
> Question: How does john know to try SHA-256 hash codes instead of, say, MD5 hash codes or some other hash?
There are some things that john looks for, basic are:
-hash lenght (in bytes)
-hash encoding
-specific prefixes like "$1$"
-salt
-iteration count
Often people have problem that they know what kind of hash they have,
but john does not reckognize that, or reckognize as different format.
If that's the case there are at least three possible solutions:
-change hash to format that is valid for john
-change john code to decode properly your format
-use another cracking tool
If you look at source of some *fmt.c file you will see that there is a:
valid(char* ciphertext) function. As far as I know john tries to fit
ciphertext to all formats, and uses first that will recognize that
that ciphertext as valid one. If there is more than one format you
will see appropriate note about that, but still it will use first fit.
There is pwafe (also for GPUs) format that you might look at.
Lukas
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
